Privacy and Security

Privacy and security

The application runs a local Python backend bound exclusively to 127.0.0.1, so it cannot be reached from your network or the internet. There are no accounts, analytics or tracking, and no information about you or your simulations leaves your machine.

The single optional network request

If, and only if, you enable update checks, the application asks api.github.com once a week for the latest published version number, so that it can tell you when a new release is available. The request carries no identifier, account, usage data or simulation content. As with any web request, GitHub can see the originating IP address; that record is held by GitHub, and neither the application nor its author receives it. Update checks are off until you opt in, your choice is remembered, and it can be changed at any time under Credits (footer, or the Case menu).

The application never downloads or executes code on its own. When a new version is available it shows a link, and the decision is yours. Software that can silently replace its own executable is an attractive route for malware if a publisher is ever compromised; this application cannot do so, even if the release page itself were taken over.

Further detail is given in PRIVACY.md and SECURITY.md; the latter also covers Host-header validation against DNS rebinding, the security headers set on every response, input range checking, and the escaping of release notes.

Source code

The source code will be published once the underlying work has been written up; until then, releases are distributed as binaries. This is a matter of timing rather than concealment, and the following remain independently verifiable in the meantime:

• SHA-256 fingerprints confirm that the file you received is exactly the file that was published.
• requirements-lock.txt records the exact library versions from which each build was produced.
• Network behaviour can be confirmed with any network monitor: no connections at all unless update checks are enabled, and a single weekly request to api.github.com if they are.

If you need access to the source before publication, for example for a review, an audit or an institutional requirement, please open an issue. Such requests are welcome and will be answered.